fix: wait for healthy deployment services

docs/DEPLOYMENT.md

@@ -67,10 +67,10 @@ uses `IMAGE_TAG` to select matching API, worker, and web images. Deploy with:
 RELEASE_TAG=2026-09-09-01 ./scripts/deploy-production.sh
 ```
 
-The deploy script builds the three tagged images, starts healthy data services,
+The deploy script builds the three tagged images, waits for healthy data
-applies migrations with the tagged API image, and then switches the application
+services, applies migrations with the tagged API image, and then switches the
-services. Keep the previous release tag and migration state with the deployment
+application services after they are healthy. Keep the previous release tag and
-record.
+migration state with the deployment record.
 
 Rollback application images with:
 
@@ -78,7 +78,8 @@ Rollback application images with:
 RELEASE_TAG=2026-09-08-02 ./scripts/rollback-production.sh
 ```
 
-Image rollback is safe only when the previous image understands the current
+The rollback script waits for the restored application services to become
+healthy before running the smoke check. Image rollback is safe only when the previous image understands the current
 database schema. If the release included an incompatible schema change, restore
 the matching PostgreSQL backup before starting the previous images. Always
 verify the API and web health checks after a rollback.

scripts/deploy-production.sh

@@ -7,8 +7,8 @@ compose_args='-f compose.production.yaml'
 export IMAGE_TAG="$RELEASE_TAG"
 
 docker compose $compose_args build api worker web
-docker compose $compose_args up -d postgres redis
+docker compose $compose_args up -d --wait postgres redis
 docker compose $compose_args run --rm api npm run db:migrate
-docker compose $compose_args up -d api worker web
+docker compose $compose_args up -d --wait api worker web
 docker compose $compose_args ps
 ./scripts/smoke-production.sh

scripts/deployment-health-wait.test.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+
+deploy_script=$(cat scripts/deploy-production.sh)
+rollback_script=$(cat scripts/rollback-production.sh)
+
+printf '%s\n' "$deploy_script" | grep -F 'up -d --wait postgres redis' >/dev/null
+printf '%s\n' "$deploy_script" | grep -F 'up -d --wait api worker web' >/dev/null
+printf '%s\n' "$rollback_script" | grep -F 'up -d --wait api worker web' >/dev/null
+
+printf '%s\n' 'deployment health wait tests passed'

scripts/rollback-production.sh

@@ -4,6 +4,6 @@ set -eu
 : "${RELEASE_TAG:?Set RELEASE_TAG to the previously deployed immutable image tag}"
 
 export IMAGE_TAG="$RELEASE_TAG"
-docker compose -f compose.production.yaml up -d api worker web
+docker compose -f compose.production.yaml up -d --wait api worker web
 docker compose -f compose.production.yaml ps
 ./scripts/smoke-production.sh